Skip to content
THREATWIRE

CVE

MediumActive Exploitation

CVE-2026-96655

Plex Media Server transcoder path parameter allows requests to arbitrary addresses

CVE-2026-96655 is part of the Plex2Shell chain in Plex Media Server before 1.43.3.10861. NVD lists CVSS 3.1 4.3 and CVSS 4.0 5.3. Fixed in 1.43.3.10861. A public repository covers the chain. Not in CISA KEV as of check. One honeypot saw exploitation on 17 October 2026.

By ThreatWire Desk · Published 23 Sept 2026 · Updated 19 Oct 2026

CVSS
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Class
SSRF
Status
Active Exploitation
KEV
Not in CISA KEV
0-day
No
Vendor
Plex
Products
Plex Media Server
Affected
Plex Media Server before 1.43.3.10861.
Fixed
Plex Media Server 1.43.3.10861 or newer. Plex announced security updates for 1.43.2 and earlier on 1 September 2026.
CWE
CWE-918
Published
23 Sept 2026
Updated
19 Oct 2026

The status above is the claim. Links do not upgrade it.

CVE-2026-96655 is an authenticated request to arbitrary internal or external addresses through the path parameter of /video/:/transcode/universal.

It is the fourth link in the chain: the researcher uses it to feed the transcoder attacker-hosted media once an owner token is held. It is one of four CVEs in the chain called Plex2Shell. The others are CVE-2026-96652, CVE-2026-96654, CVE-2026-96656. Plex Media Server before 1.43.3.10861 is affected.

NVD lists CVSS 3.1 4.3 and CVSS 4.0 5.3 for this CVE. NVD maps it to CWE-918. The CVE was published on 23 September 2026.

A researcher published a write-up on 16 October 2026 and a repository that covers all four CVEs. ThreatWire has not run it. On 17 October 2026 another researcher reported seeing the published code used against an internet-facing honeypot that ran an older Plex version. That is one honeypot, not a confirmed mass campaign. See the ThreatWire article on the full chain for details.

The CVE is not in the CISA KEV catalog as of 19 October 2026.

What to do: update Plex Media Server to 1.43.3.10861 or newer and do not expose port 32400 to the internet unless you need to.

Sources

Related writing

Share on X@threatwire_https://www.threatwire.tech/cve/cve-2026-96655